Tuesday, February 11, 2025
HomeCVE/vulnerabilityQNAP Warns of DeadBolt Ransomware Attacks Exploiting a Zero-day Flaw

QNAP Warns of DeadBolt Ransomware Attacks Exploiting a Zero-day Flaw

Published on

SIEM as a Service

Follow Us on Google News

QNAP Systems, Inc found a new DEADBOLT ransomware attacks that exploits zero-day vulnerability in Photo Station. QNAP urges all QNAP NAS users to update Photo Station to the latest available version.

“QNAP® Systems, Inc. today detected the security threat DEADBOLT leveraging exploitation of Photo Station vulnerability to encrypt QNAP NAS that are directly connected to the Internet,” security notice from QNAP.

The company noticed DeadBolt ransomware campaign on September 3rd, 2022. “The campaign appears to target QNAP NAS devices running Photo Station with internet exposure”, QNAP.

The company did not share CVE for the vulnerability however the company fixed the Photo Station vulnerability within 12 hours of its use by DeadBolt actors and advised users to take a range of actions to protect themselves, including making sure their devices are not exposed to the internet.

A surge in DeadBolt submissions to ID Ransomware

A surge in DeadBolt submissions to ID Ransomware (BleepingComputer)

The attacks were extensive, with the ID Ransomware service seeing a surge in submissions on Saturday and Sunday.

Patches Released

  • QTS 5.0.1: Photo Station 6.1.2 and later
  • QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later
  • QTS 4.3.6: Photo Station 5.7.18 and later
  • QTS 4.3.3: Photo Station 5.4.15 and later
  • QTS 4.2.6: Photo Station 5.2.14 and later

The company says that QuMagie is a simple and powerful alternative to Photo Station. Therefore it is recommended using QuMagie to efficiently manage photo storage in your QNAP NAS.

 “We strongly urge that their QNAP NAS should not be directly connected to the internet. We recommend users to make use of the myQNAPcloud Link feature provided by QNAP, or enable the VPN service.” – QNAP.

How to Protect your NAS from the DeadBolt Ransomware? 

  • Disable the port forwarding function on the router.
  • Set up myQNAPcloud on the NAS to enable secure remote access and prevent exposure to the internet.
  • Update the NAS firmware to the latest version.
  • Update all applications on the NAS to their latest versions.
  • Apply strong passwords for all user accounts on the NAS.
  • Take snapshots and back up regularly to protect your data.

Secure Azure AD Conditional Access – Download Free White Paper

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Authorities Seize 8Base Ransomware Dark Web Site, Arrest Four Key Operators

Thai authorities arrested four European hackers in Phuket on February 10, 2025, for their...

12,000+ KerioControl Firewalls Exposed to 1-Click RCE Attack

Cybersecurity researchers caution that over 12,000 instances of GFI KerioControl firewalls remain unpatched and...

Apple iOS 0-day Vulnerability Exploited Wild in Extremely Sophisticated Attack

Apple has released emergency security updates to address a zero-day vulnerability, CVE-2025-24200, that has...

SHA256 Hash Calculation from Data Chunks

The SHA256 algorithm, a cryptographic hash function, is widely used for securing data integrity...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Authorities Seize 8Base Ransomware Dark Web Site, Arrest Four Key Operators

Thai authorities arrested four European hackers in Phuket on February 10, 2025, for their...

12,000+ KerioControl Firewalls Exposed to 1-Click RCE Attack

Cybersecurity researchers caution that over 12,000 instances of GFI KerioControl firewalls remain unpatched and...

Apple iOS 0-day Vulnerability Exploited Wild in Extremely Sophisticated Attack

Apple has released emergency security updates to address a zero-day vulnerability, CVE-2025-24200, that has...